gravit-designer-security-analysis

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The GitHub repository https://github.com/SHOYEBUL1/gravit-design-toolkit-unlocker is flagged in the skill as a likely malware distribution/“unlocker” (unknown user, no source, external downloads), while the other URLs are official vendor or service endpoints and not inherently suspicious.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill includes multiple commands that require sudo or modify the system (e.g., sudo tcpdump, package installs and downloading/running executables), which could change the machine's state if executed, but it does not instruct creating users, altering system/ssh/service files, or explicitly asking the agent to bypass security—so it is low-to-moderate risk.